amltestwallet[.]icu

The domain amltestwallet.icu was created on 23 December 2025 and is currently offline. DNS resolution points to the IP address 172.67.166.244, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The domain is hosted on Cloudflare’s network and uses the authoritative nameservers rodrigo.ns.cloudflare.com and shubhi.ns.cloudflare.com, both typical of Cloudflare‑protected sites. No TLS certificate was observed for the domain, indicating that HTTPS was not configured at the time of analysis. The registrar record shows registration through PDR Ltd. d/b/a PublicDomainRegistry.com.

The page title returned by the HTTP response was "AML Bot", matching the declared brand target AMLBot. The threat classification is listed as a crypto scam that employs brand impersonation. The domain appears on a single security blocklist and has been flagged by PhishDestroy. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. VirusTotal analysis reports that three of ninety‑three scanned security vendors flagged the domain, suggesting that at least a subset of scanners identified malicious behavior.

Given the combination of a brand‑specific page title, a low trust score, blocklist inclusion, and partial detection by multiple vendors, the observable evidence points to a credential‑stealing or crypto‑related phishing campaign that mimics AMLBot. The lack of an SSL certificate and the domain’s offline status limit current visibility into the exact payload or landing page content. Defenders should continue to block the domain at network perimeters, update URL filtering rules to include amltestwallet.icu, and monitor any future resolution attempts to the associated Cloudflare IP. Ongoing surveillance of the IP address and associated nameservers is recommended, as Cloudflare‑based infrastructure can be repurposed for new malicious domains.